Does someone know of a project or a way to "fingerprint" an access point (a router)? Fingerprinting should be done irrespective of broadcastet BSSID and ESSID. BSSID and ESSIS may be included in the fingerprint, but they should not be the only indicators.
One interesting fingerprint you could use is the clock skew. Since 802.11 APs typically broadcast their timestamp in beacon frames, the beacon frames provide a nice source of the devices clock skew. For more details, see "On Fast and Accurate Detection of Unauthorized Wireless Access Points Using Clock Skews".
How do you want to fingerprint access points; through OSI layer 1, 2, or above?
If you want to fingerprint them via OSI layer 3 or above, check out http://www.hping.org/; it sounds promising - but I think its' fingerprinting abilities probably do not include access points; however, I've not tried it.
You can use nmap to carry out an element of this (if you look at the management port of the access point) - but this won't help you much if all you can see is the wireless part of the network and no ports are open on the access point's wireless network interface.